How we avoided side-channels in our new post-quantum Go cryptography libraries

Summary: Trail of Bits released open-source pure Go implementations of ML-DSA (FIPS-204) and SLH-DSA (FIPS-205), the NIST-standardized post-quantum signature algorithms, engineered to be constant time. The team removed branches and division from ML-DSA's Decompose algorithm - the kind of division that caused the KyberSlash timing attack on early Kyber implementations - using constant-time conditional swaps and Barrett reduction with precomputed values for the fixed parameter gamma-2 (95232 for ML-DSA-44, 261888 for ML-DSA-65 and ML-DSA-87).
Key Takeaway: Division in the ML-DSA specification was the same root cause behind KyberSlash, which hit early Kyber implementations before it became ML-KEM - so any post-quantum signature code you adopt should be checked for exactly this timing leak.

Read the original at Trail of Bits Blog ↗